@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner-deps.d.ts

@@ -15,7 +15,7 @@ import type { Brain, ModelRef, ModelRoles } from "./model-seat.js";
 import type { RuntimeCaps, WorkflowGovernanceBaseline } from "./runtime-caps.js";
 /**
  * parity-204 — structured `RunnerDeps.loadProjectMemory` return (backward-compatible, RL-1336-project-memory-bare: a bare
- * `string | null` keeps its exact historical meaning). Adds the CC 2.1.204 `seededFromContext`
+ * `string | null` keeps its exact historical meaning). Adds the `seededFromContext`
  * seam (cc204-bundle @17917159: CC preloads readFileState for CLAUDE.md/nested-memory files it
  * placed in context, and a DEFAULT whole-file Read of an unchanged seeded file answers with the
  * already-in-context reminder instead of re-transmitting the body — token economy, GA in 204).
@@ -27,7 +27,7 @@ export interface ProjectMemoryLoad {
      * Files whose FULL, disk-verbatim text the deployment has placed in the model's context (e.g. the
      * CLAUDE.md that `content` embeds). The Runner pre-seeds the hands' read state (through the same
      * resolveKey containment as a real Read — an out-of-root path is silently skipped), so a default
-     * whole-file Read of an UNCHANGED seeded file returns the CC-verbatim reminder
+     * whole-file Read of an UNCHANGED seeded file returns the reminder
      * (`This file is already in your context (see "Contents of <path>" above) and has not changed on
      * disk…`) instead of the body. `content` here MUST be the file's exact disk text at load time —
      * the unchanged check hashes it; never declare a truncated/annotated variant (CC's `isPartialView`
@@ -52,10 +52,8 @@ export interface ProjectMemoryLoad {
      */
     instructionSources?: ReadonlyArray<{
         path: string;
-        /** (additive widening): `null` = the source is DECLARED but currently
-         *  ABSENT from disk — the change probe then watches for its APPEARANCE (renders "absent → hash").
-         *  Runtime already handled null (collectInstructionsChange's from===null arm); this widening
-         *  only aligns the declared type with the shipped behavior. */
+        /** `null` = the source is DECLARED but currently ABSENT from disk — the change probe then watches for
+         *  its APPEARANCE (renders "absent → hash"). */
         contentHash: string | null;
     }>;
 }
@@ -240,13 +238,13 @@ export interface RunnerDeps {
      */
     agentConfigDir?: string;
     /**
-     * backlog #286 (#279 — CC 2.1.233 `DANGEROUS_FILES`/`DANGEROUS_DIRECTORIES`/
+     * backlog #286 (#279 — `DANGEROUS_FILES`/`DANGEROUS_DIRECTORIES`/
      * `DANGEROUS_DIRECTORY_PATHS` parity): the WRITE-protection table. DEFAULT-ON: a path-confinable
      * write (Write/Edit/NotebookEdit) whose target lands on a table row has a surviving `allow`
      * demoted to `ask` at the tool gate (`decisionReason: "safety"`; a deny/ask verdict is untouched;
      * approval flows the ordinary ask-resolution chain — classifier, blanket `onAsk`, durable park —
      * with no `requiresRealApproval` mandate). Absent =
-     * {@link import("./write-protect.js").WRITE_PROTECTED_DEFAULT_TABLE} (the CC triple verbatim +
+     * {@link import("./write-protect.js").WRITE_PROTECTED_DEFAULT_TABLE} (the reference triple +
      * the two argued sema rows). This key IS the whole-table escape hatch, deployment seat ONLY — the
      * task layer's twin is add-only ({@link TaskSpec.writeProtectedAdditions}: its rows UNION this
      * table and can remove none), and no governed-workflow channel reaches either: `[]` = no table (explicit and legal); a non-empty
@@ -545,6 +543,8 @@ export interface RunnerDeps {
     fileHistoryStore?: import("./file-history-store.js").FileHistoryStore | "disabled";
     /** The deployment's CAPTURE switch, apart from the store seat: `"off"` (the only word, and only beside a wired store; anything else refuses prepare, `config.invalid_file_history_capture`) ⇒ no run records — no first-touch record, no turn boundary, no fork carry, no liveness advisory, manifest `fileHistory: "disabled"` — while a wired {@link fileHistoryStore} still serves {@link TaskSpec.restoreFiles} / {@link TaskSpec.rewindFilesTo} from what it already holds. */
     fileHistoryCapture?: "off";
+    /** The deployment's ADVISOR switch: `"disabled"` (the only word; anything else refuses prepare, `config.advisor_tool_invalid`) ⇒ no leg attaches the `advisor` tool and every {@link TaskSpec.advisorModel} is ignored unread — manifest `advisor: { state: "not_attached", reason: "disabled" }`, no notice. */
+    advisorTool?: "disabled";
     /**
      * design/381 DV-14 (终审落锤) — what an Edit/Write/NotebookEdit does when its FIRST-TOUCH history
      * record cannot be persisted (`FileHistoryStore.trackEdit` answered `{ok:false}` = NO durable
@@ -563,13 +563,13 @@ export interface RunnerDeps {
      */
     onTrackFailure?: "refuse" | "proceed-unprotected";
     /**
-     * design/99 §E6 — DURABLE per-session permission rules (a deny-narrowing folded into the task-time tool
-     * policy). Omitted ⇒ the feature is OFF (no rules read, zero behavior change). A deployment supplies a
-     * cross-replica backend whose CAS-rev + tighten-only semantics match the core
-     * {@link import("./session-policy-store.js").InMemorySessionPolicyStore}. Rules are read at prepare time for a
-     * task carrying its own `sessionId` (a delegated subagent inherits none) and composed BEFORE the caller
-     * policy, so they can only SUBTRACT capability. core does NOT verify owner/operator identity — the store
-     * honors the `operator` flag the (service) caller freezes from a verified principal.
+     * design/99 §E6 — DURABLE per-session permission rules (a deny-narrowing folded into the task-time tool policy).
+     * Omitted ⇒ OFF (no rules read). A deployment's cross-replica backend matches the CAS-rev + tighten-only semantics of
+     * {@link import("./session-policy-store.js").InMemorySessionPolicyStore}. A task carrying its own `sessionId` has its
+     * rules re-read at every tool gate of its own AND of every delegated leg; a descendant reads the key from ITS runner's store,
+     * whichever that is — none ⇒ it keeps its spawn-time snapshot and announces `config.session_rules_unreadable`; a DIFFERENT
+     * store answers for the key itself, silently (no row there ⇒ nothing binds), so give delegation runners this same store.
+     * Composed BEFORE the caller policy, they only SUBTRACT capability. core does NOT verify owner/operator identity — the store honors the `operator` flag the caller freezes from a verified principal.
      */
     sessionPolicyStore?: import("./session-policy-store.js").SessionPolicyStore;
     /**
@@ -730,9 +730,9 @@ export interface RunnerDeps {
      * engine-spawned child) AND this face is present AND the per-principal DENY bit is not set
      * ({@link RuntimeCaps.autoMode}` !== false` — absent is not a denial).
      *
-     * 🔐 Trust gate (the CC 2.1.207 three-source invariant): classifier RULES enter EXCLUSIVELY
+     * 🔐 Trust gate (the three-source invariant): classifier RULES enter EXCLUSIVELY
      * here — a deployment-constructed object, never a `TaskSpec` field, never a repo-file plane. The
-     * prompt is assembled from the SHA-locked CC 2.1.207 assets (`buildAutoModePrompt`) with these
+     * prompt is assembled from the SHA-locked reference assets (`buildAutoModePrompt`) with these
      * rules merged CC-exactly (user rules replace a section; the `"$defaults"` sentinel splices the
      * stock rules back in). The classify leg runs on the `classifier` role's model (fallback
      * `summarize → default`; tier default `flash`) via the brain's simple-completion pipe — same
@@ -747,7 +747,7 @@ export interface RunnerDeps {
         isolatePeers?: true;
     };
     autoMode?: {
-        /** Rule overrides for the four permissions sections (omitted section = CC defaults verbatim). */
+        /** Rule overrides for the four permissions sections (omitted section = the defaults). */
         rules?: import("./auto-mode-prompt.js").AutoModeRules;
         /** Settings-plane deny rules rendered into the `<settings_deny_rules>` slot (circumvention catch). */
         settingsDenyRules?: readonly string[];
@@ -784,7 +784,7 @@ export interface RunnerDeps {
          */
         classifierFallback?: import("./auto-mode.js").AutoModeClassifierFallback;
         /**
-         * The classifier DENIAL LIMIT (CC 2.1.250 `FO`/`AKe`): a run whose classifier keeps blocking falls
+         * The classifier DENIAL LIMIT: a run whose classifier keeps blocking falls
          * back to a PERSON instead of being denied without end. Per run: a `block` first increments the
          * consecutive and total counts and then judges `consecutive >= maxConsecutive || total >= maxTotal`
          * — the block that reaches a bound is itself the one that becomes an `ask` (the 3rd consecutive
@@ -942,19 +942,19 @@ export interface RunnerDeps {
      *  `SendMessageToolOptions.lane` and into the session-box drain; read per call / per pass. */
     peerLane?: Partial<import("../agents/peer-admission.js").PeerLaneConfig>;
     /**
-     * design/385 §2.1 / §5.1 — the peer-session DIRECTORY: the discovery truth of the cross-session
-     * lane (other sessions of this engine for the same user). A HOST implements the contract (cli: the
-     * pid-keyed registration files; server: its session table) and writes the rows; the engine only
-     * reads them. Seat semantics = the mailbox seat's: NO seat, NO lane — every face stays byte-identical
-     * to a pre-385 build. With the seat wired the engine (a) mounts `ListAgents` (alias `ListPeers`),
-     * (b) opens SendMessage's `session.<id>` address arm and its last `name [ref]` rung, (c) drains this
-     * session's own `session.<sessionId>` box at every turn boundary (the mailbox contract's third
-     * consumption chain), and (d) splices the cross-session rule into the auto-mode classifier slot.
-     * HARD PRECONDITION (design/385 §1.2⑥): `mailboxStore` must be wired AND declare
-     * `crossProcessSafe: true`; otherwise the lane is REFUSED at prepare with a named
-     * `config.peer_lane_unmounted` notice (never mounted on luck), and the seat is inert for that run.
+     * design/385 §2.1 / §5.1 — the peer-session DIRECTORY: the discovery truth of the cross-session lane (other sessions
+     * of this engine for the same user). A HOST implements the contract (cli: the pid-keyed registration files; server: its
+     * session table) and writes the rows; the engine only reads them. Seat semantics = the mailbox seat's: NO seat, NO lane —
+     * every face stays byte-identical to a pre-385 build. With the seat wired the engine (a) mounts `ListAgents` (alias
+     * `ListPeers`), (b) opens SendMessage's `session.<id>` address arm and its last `name [ref]` rung, (c) drains this
+     * session's own `session.<sessionId>` box at every turn boundary (the mailbox contract's third consumption chain), and
+     * (d) splices the cross-session rule into the auto-mode classifier slot. HARD PRECONDITION (design/385 §1.2⑥):
+     * `mailboxStore` must be wired AND declare `crossProcessSafe: true`; otherwise the lane is REFUSED at prepare with a
+     * named `config.peer_lane_unmounted` notice (never mounted on luck), and the seat is inert for that run.
      */
     peerDirectory?: import("../agents/peer-directory.js").PeerDirectory;
+    /** The cross-session SOCKET channel ({@link import("./peer-channel.js").PeerChannel}; bundled: `createCcUdsPeerChannel`, the reference agent's dialect). SendMessage reads each target row's lane once (`peerSessionLane`, against {@link mailboxStore}'s `identity`): a row whose capability bit names this store keeps its box append and its socket gets a content-free doorbell; any other row with a socket (a reference-agent session, a session of this engine on another store) gets the message over its socket, at-most-once (`via: "uds"`). Absent ⇒ such a row refuses `peer_send.not_reachable`, never an append into a box nobody drains; every other face is unchanged. The engine never listens (a host calls `listen`). Inert without {@link peerDirectory}. */
+    peerChannel?: import("./peer-channel.js").PeerChannel;
     /**
      * design/385 §4.4 — this deployment's `crossSessionInbound` setting LAYERS for the drain-point
      * judgment (managed / user / repo, resolved by `resolveCrossSessionInboundSetting` — explicit value
@@ -977,7 +977,7 @@ export interface RunnerDeps {
         assistant: string;
     };
     /**
-     * design/385 §4.4 (slice 4) — this deployment's `dialogExpiry` (CC settings key, verbatim vocabulary
+     * design/385 §4.4 (slice 4) — this deployment's `dialogExpiry` (settings key, vocabulary
      * `"60s" | "5m" | "10m" | "never"`, default `"5m"`): how long a HELD cross-session message whose cause
      * a human review could resolve (mode-mismatch / no-mode-asserted / invalid attestation) waits in this
      * session's held queue before it resolves to its safe no-action default — EXPIRED, dropped WITH a
@@ -1079,7 +1079,7 @@ export interface RunnerDeps {
     /**
      * design/138 S1 — the NEW-ARCHITECTURE memory seam (MemoryEngine over a {@link import("./memory-engine/types.js").MemoryBackend}).
      * When set AND `spec.memory.enabled`, the task runs the INJECTION-FIRST file-based memory lifecycle
-     * (materialize → session file ops → harvest with the full gate set), the CC-verbatim `# Memory`
+     * (materialize → session file ops → harvest with the full gate set), the `# Memory`
      * instruction + fenced derived index replace the legacy `<user_memory>` block, and NO remember/recall
      * tools are mounted (memory = the model's ordinary file skills). **S4: unset ⇒
      * the task runs MEMORY-LESS** — the legacy `memoryStore` runtime path was retired (one deprecation
@@ -1288,13 +1288,13 @@ export interface RunnerDeps {
      * never instead of them. A `classic.PreToolUse` handler's `allow` never bypasses `toolPolicy` — the policy is always
      * the final say.
      */
-    mods?: readonly import("./mods/kernel/index.js").ModRegistration<import("./mods/dollar.js").EngineDollar>[];
+    mods?: readonly import("./mods/classic-events.js").EngineModRegistration[];
     /**
-     * Policy for remote image URLs (`TaskSpec.images[].url`). Return false to reject. When set it
-     * **replaces** the built-in SSRF guard (https-only + private/reserved-host block) — e.g. supply a
-     * CDN allowlist, or a stricter resolve-and-pin check. Omit to use the safe default.
+     * The deployment's HOST FLOOR (`{ deny?, only? }`, host patterns `example.com` / `*.example.com`): read by the gate (a deny-only layer no rule, mode or
+     * approver clears) and by the engine executors before they connect — the fetch tool's every hop, task images, each MCP http dial (pooled included), every
+     * A2A request and hop, WebSearch's SearXNG backend request and every redirect hop. `only` present ⇒ nothing else is reachable (it also lifts the private-network floor for a host it names); read once at construction (a frozen copy), a bad value refuses (`config.host_floor_invalid`).
      */
-    allowImageUrl?: (url: string) => boolean;
+    hostFloor?: import("./host-floor.js").HostFloorDeclaration;
     /**
      * Optional sink for best-effort background errors/warnings that are otherwise swallowed:
      * - `"compaction"` — a compaction failure (F8); a persistently failing one (flaky gateway, empty
@@ -1326,9 +1326,9 @@ export interface RunnerDeps {
      *   simply carries no suggestions.
      * - `"rewind"` — the file-history machinery backing rewind reported a best-effort failure: a
      *   turn-start boundary capture failed or timed out (that turn cannot be rewound to; the turn
-     *   itself proceeds), or a first-touch failure was tolerated under
-     *   `onTrackFailure:"proceed-unprotected"`. (design/381: the whole-tree size gate and its
-     *   `classification:"too_large"` payload are retired — per-edited-file history has no size axis.)
+     *   itself proceeds), a first-touch failure was tolerated under `onTrackFailure:"proceed-unprotected"`, a
+     *   first-touch record could not be retracted, or a fork's history carry failed. `err` is always a
+     *   `FileHistoryStoreError`: read its `code` / `permanence`, never the message text.
      * - `"hook"` — a deployment hook misbehaved: a callback threw, or returned a verdict it was not
      *   allowed to (e.g. a declared-observational hook). The engine applies the hook's own documented
      *   fallback (swallow, or fail-closed deny, per its contract) and reports the fact here.
@@ -1415,7 +1415,7 @@ export interface RunnerDeps {
     /**
      * design/374 — the microCompact knobs. Both default ON (`machine: "cc"`, `clearOnRejection: true`).
      *
-     *  - `machine`: `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings
+     *  - `machine`: `"cc"` (default: the rejection-leg form — keep 5, ≥20k minimum-savings
      *    gate, one deep clear beyond the keep window, CC marker bytes) or `"off"` (no proactive
      *    frontier clearing at all — the D-2 off switch; the machine then gets its ONE shot at the
      *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The vocabulary is
@@ -1452,7 +1452,7 @@ export interface RunnerDeps {
     cacheBreakDetection?: boolean;
     /**
      * Aggregate inline-MEDIA (image) byte budget for the request (batch-C/§17.2 sibling of the text budget;
-     * CC 2.1.196 `tengu_media_byte_cap` parity). Image reads (`Read` → ImageContent) are per-image-capped but
+     * `tengu_media_byte_cap` in the reference). Image reads (`Read` → ImageContent) are per-image-capped but
      * accumulate across turns; this bounds the SUM in the request by stripping the OLDEST images (replaced with a
      * marker) — request-only, non-destructive (the durable session keeps the image; the model can re-Read it).
      * The same budget bounds the media of one `tool_end.output` (spent there as base64 on the wire, x 4/3); both readers

package/dist/core/runtime-caps.d.ts

@@ -86,7 +86,7 @@ export interface WorkflowGovernanceBaseline {
  */
 /**
  * #692 C-d — WHICH plane's ratchet denied auto mode, when the resolver knows: the three settings sources
- * CC 2.1.250's `permissions.disableAutoMode` can come from, as the resolver folds them into the one deny bit
+ * the reference's `permissions.disableAutoMode` can come from, as the resolver folds them into the one deny bit
  * ({@link RuntimeCaps.autoMode} `=== false`). `org` = a managed / organization policy plane; `local` = the
  * machine's local settings; `settings` = the user's / project's settings file. Read ONLY beside the deny bit
  * (a source with no denial is a contradiction the value screen refuses as a resolver fault); projected onto
@@ -112,7 +112,7 @@ export interface RuntimeCaps {
      *  deployment, never GRANT beyond it. */
     allowFork?: boolean;
     /**
-     * Observer agents (CC 2.1.206 parity, docs/CC206-OBSERVER-ANCHORS-2026-07-11.md §6): honor
+     * Observer agents: honor
      * {@link AgentDefinition.observer} auto-spawn declarations. **POLARITY NOTE — unlike
      * `allowWorkflows`/`allowFork` (`undefined` = unrestricted), this one is `=== true` EXPLICIT
      * opt-in, default OFF**: CC's gate pair is a default-UNSET experimental env var
@@ -133,7 +133,7 @@ export interface RuntimeCaps {
      *  must not demote a reachable person into the model answering for them). */
     forceDurableGate?: boolean;
     /**
-     * The per-principal auto-mode DENY bit (CC 2.1.250 polarity — the mirror of the settings-plane
+     * The per-principal auto-mode DENY bit (the mirror of the settings-plane
      * `permissions.disableAutoMode` ratchet: an organization may only take auto mode AWAY; it is the
      * USER who turns it on, by requesting the mode at {@link TaskSpec.permissionMode}).
      *
@@ -145,7 +145,7 @@ export interface RuntimeCaps {
      * unset. The arming itself: intent ∧ {@link RunnerDeps.autoMode} present ∧ this bit not `false`
      * (allow → run; block → deny `source:"classifier"`; classifier failure → FAIL-CLOSED back to the
      * original ask chain). The trust gate is unchanged: classifier RULES enter only through the
-     * deployment assembly face, never a repo-controlled plane (the CC 2.1.207 three-source invariant).
+     * deployment assembly face, never a repo-controlled plane (the three-source invariant).
      * A denial resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
      */
     autoMode?: boolean;

package/dist/core/safety-axis-vocab.d.ts

@@ -31,7 +31,9 @@ export declare const SAFETY_AXIS_VOCABULARY: {
     readonly permissionDecision: readonly ["allow", "ask", "deny"];
 };
 /** The mark tighten's sentence — the ONE spelling of each safety-mark frame (an egress-marked tool = an external write; an
- *  always-irreversible tool; a tool whose server declared that a call must be put to a person), read by the gate's two tighten arms (`gate-fold.ts`) and by the inherited lane's card for a
- *  marked tool (`judgeInheritedClassifier`): a person who answers a card for a marked call is told what the mark means,
- *  whichever lane minted the card. */
-export declare function markTightenMessage(toolName: string, mark: "egress" | "irreversible" | "interaction"): string;
+ *  always-irreversible tool; a tool that may be irreversible, `"maybe"`, whose call nothing showed reversible — its probe's own
+ *  account rides the card's `probeReason`, never this sentence; a tool whose server declared that a call must be put to a
+ *  person), read by the gate's two tighten arms (`gate-fold.ts`) and by the inherited lane's card for a marked tool
+ *  (`judgeInheritedClassifier`): a person who answers a card for a marked call is told what the mark means, whichever lane
+ *  minted the card. */
+export declare function markTightenMessage(toolName: string, mark: "egress" | "irreversible" | "unproven" | "interaction"): string;

package/dist/core/safety-axis-vocab.js

@@ -10,9 +10,10 @@ export const SAFETY_AXIS_VOCABULARY = {
 const _toolEffectExhaustive = true;
 void _toolEffectExhaustive;
 export function markTightenMessage(toolName, mark) {
-    if (mark === "interaction")
-        return `tool "${toolName}" asks for a person's confirmation (server-declared) — explicit approval required`;
-    return mark === "egress"
-        ? `tool "${toolName}" performs an external write (egress) — explicit approval required`
-        : `tool "${toolName}" performs an irreversible action — explicit approval required`;
+    switch (mark) {
+        case "interaction": return `tool "${toolName}" asks for a person's confirmation (server-declared) — explicit approval required`;
+        case "egress": return `tool "${toolName}" performs an external write (egress) — explicit approval required`;
+        case "irreversible": return `tool "${toolName}" performs an irreversible action — explicit approval required`;
+        case "unproven": return `tool "${toolName}" was not shown to be reversible — explicit approval required`;
+    }
 }

package/dist/core/safety-merge-corpus.js

@@ -177,12 +177,36 @@ export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
     },
     {
         name: "inert-deny-entry-removed-safe",
-        intent: "removing a deny entry the grammar reads that names nothing (a wildcard peer, a `__` name with no protocol prefix) relaxes nothing — the comparison reads the EFFECTIVE entries on both sides",
-        prior: { toolDeny: ["Bash", "mcp__*", "github__x"] },
+        intent: "removing a deny entry the grammar reads that names nothing (a `__` name with no protocol prefix) relaxes nothing — the comparison reads the EFFECTIVE entries on both sides",
+        prior: { toolDeny: ["Bash", "github__x"] },
         next: { toolDeny: ["Bash"] },
         loosens: false,
         reasons: [],
     },
+    {
+        name: "glob-deny-removed-loosened",
+        intent: "a `*` anywhere in a deny entry's name is a wildcard over the whole name (`mcp__git*` every peer it matches, `Re*d` every tool it matches, `*` every tool): removing one lifts a real deny",
+        prior: { toolDeny: ["Bash", "mcp__git*", "Re*d"] },
+        next: { toolDeny: ["Bash"] },
+        loosens: true,
+        reasons: ['removed toolDeny "mcp__git*"', 'removed toolDeny "Re*d"'],
+    },
+    {
+        name: "whole-protocol-deny-removed-loosened",
+        intent: "`mcp__*` and `mcp__*__*` in a deny list name every tool of every MCP server: removing either lifts a real deny",
+        prior: { toolDeny: ["Bash", "mcp__*"] },
+        next: { toolDeny: ["Bash"] },
+        loosens: true,
+        reasons: ['removed toolDeny "mcp__*"'],
+    },
+    {
+        name: "whole-protocol-deny-both-spellings-removed-loosened",
+        intent: "each whole-protocol spelling is its own deny entry: dropping one while keeping the other still removes an entry the base layer wrote",
+        prior: { toolDeny: ["mcp__*", "mcp__*__*"] },
+        next: { toolDeny: ["mcp__*"] },
+        loosens: true,
+        reasons: ['removed toolDeny "mcp__*__*"'],
+    },
     {
         name: "unreadable-deny-prior-loosened",
         intent: "rules whose toolDeny holds an entry no rule grammar reads (an empty entry) cannot be read and refuse every call — an override that can be read loosens them",

package/dist/core/same-plain-value.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The conservative value-sameness proof the park mint reads when it decides whether a fidelity projection
+ * moved a value, and whether a policy's rewrite names the very value about to be filed. A leaf: no imports.
+ */
+/**
+ * CONSERVATIVE "these two are provably the same value" for deciding whether a
+ * {@link import("./checkpoint-store.js").encodeAtFidelity} projection moved anything, and whether a policy's
+ * rewrite names the very value about to be filed.
+ *
+ * Deliberately NOT the binding hash, which is the wrong instrument for this question in two directions:
+ * it folds `-0` onto `0` (a real projection change the policy may care about, invisible to the hash), and
+ * it is a digest, so a collision would read as sameness. `Object.is` at the leaves keeps the `-0`
+ * distinction; comparing own-key SETS keeps the dropped `undefined`-valued key visible.
+ *
+ * Conservative on purpose — the answer it must never give wrongly is TRUE, because both callers read
+ * TRUE as "nothing moved / the policy named this very value" and act by filing. So sameness has to be
+ * PROVED, not merely un-disproved:
+ *  - the PROTOTYPES must match and be the plain-object or array one. `[object Object]` is not proof of
+ *    a plain object — a class instance and a null-prototype object both report it, and a tool executing
+ *    the arguments can observe inherited behaviour. (Neither input to the projection comparison can be
+ *    such a value: `structuredClone` and `JSON.parse` both produce plain data. A policy's rewrite can.)
+ *  - own keys are compared with `Reflect.ownKeys` and POSITIONALLY, so a SYMBOL key or a non-enumerable
+ *    property on one side is a difference rather than an invisible extra, and so is a different order
+ *    (which `Object.keys`, `JSON.stringify` and any tool iterating its arguments can see).
+ *  - properties are compared through their DESCRIPTORS — every flag, so a frozen object is not the
+ *    mutable value a JSON decode produces — and an accessor on either side answers FALSE without being
+ *    read: an approval decision must not be made by running deployment code, and what a getter returns
+ *    need not be the same twice.
+ *  - reference TOPOLOGY counts: two properties that share one object are not two properties holding
+ *    equal objects, and a JSON round trip is precisely what turns the first into the second.
+ *  - what it CANNOT prove on its own is that the value it inspected answers ordinary reads the way its
+ *    descriptors did — a Proxy reports the target's descriptors and can return anything from a `get`.
+ *    A caller comparing a value it did not construct must first establish that it is an inert data
+ *    graph (the capture clone does exactly that, and refuses a Proxy outright).
+ *  - any brand outside plain object/array that is not already reference-identical answers FALSE (a Date
+ *    is never the string a JSON codec leaves behind, a Map is never the `{}`), and so does any
+ *    inspection that throws.
+ * An uncertain answer therefore costs a policy consultation or a park, never a silently filed value.
+ */
+export declare function samePlainValue(a: unknown, b: unknown): boolean;

package/dist/core/same-plain-value.js

@@ -0,0 +1,49 @@
+const MAX_SAME_VALUE_DEPTH = 256;
+export function samePlainValue(a, b) {
+    return sameValueAt(a, b, 0, new Map(), new Map());
+}
+function sameValueAt(a, b, depth, aToB, bToA) {
+    if (Object.is(a, b))
+        return true;
+    if (depth >= MAX_SAME_VALUE_DEPTH)
+        return false;
+    if (a === null || b === null || typeof a !== "object" || typeof b !== "object")
+        return false;
+    try {
+        const pairedWithA = aToB.get(a);
+        const pairedWithB = bToA.get(b);
+        if (pairedWithA !== undefined || pairedWithB !== undefined)
+            return pairedWithA === b && pairedWithB === a;
+        aToB.set(a, b);
+        bToA.set(b, a);
+        const proto = Object.getPrototypeOf(a);
+        if (proto !== Object.getPrototypeOf(b))
+            return false;
+        if (proto !== Object.prototype && proto !== Array.prototype)
+            return false;
+        if (Object.isExtensible(a) !== Object.isExtensible(b))
+            return false;
+        const ka = Reflect.ownKeys(a);
+        const kb = Reflect.ownKeys(b);
+        if (ka.length !== kb.length)
+            return false;
+        for (const [i, k] of ka.entries()) {
+            if (k !== kb[i])
+                return false;
+            const da = Object.getOwnPropertyDescriptor(a, k);
+            const db = Object.getOwnPropertyDescriptor(b, k);
+            if (da === undefined || db === undefined)
+                return false;
+            if (!("value" in da) || !("value" in db))
+                return false;
+            if (da.enumerable !== db.enumerable || da.writable !== db.writable || da.configurable !== db.configurable)
+                return false;
+            if (!sameValueAt(da.value, db.value, depth + 1, aToB, bToA))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/scheduler.d.ts

@@ -111,7 +111,7 @@ export interface ScheduledTaskSummary {
     /** 下次触发的 epoch ms（cron/at 可算；daemon 提供）。 */
     nextRunMs?: number;
     /** 执行形态回显（{@link ScheduledIntent.mode}）。ScheduleWakeup 的 stop:true 靠它定位要取消的 pending
-     *  wakeup（cron/task 意图不受 stop 影响——CC 206 D9 语义）。老 backend 不回 = undefined（工具壳以
+     *  wakeup（cron/task 意图不受 stop 影响）。老 backend 不回 = undefined（工具壳以
      *  label 兜底过滤）。 */
     mode?: "task" | "session-wakeup";
     /** [c209-D2]：生命周期层级回显（{@link ScheduledIntent.lifetime}）——缺了它，任务创建后就再无

package/dist/core/secret-env.d.ts

@@ -112,6 +112,9 @@ export declare function declareWithheldEnv(table: WithheldEnvDeclaration): void;
  * the peer is not dialed.
  */
 export declare function holdOwnCredentialValues(values: Iterable<string | undefined>, onNotice?: (notice: EngineNotice) => void): void;
+/** The part of a `<word> <rest>` value after its first word and the spaces that follow it (`Bearer x` → `x`), or undefined when the value does
+ *  not read that way. The cut is made of the VALUE's shape, whatever the header is called. */
+export declare function authSchemeCredentials(value: string): string | undefined;
 /** THE one reading of which HTTP header carries a credential by its NAME — the credential vocabulary's header-name
  *  reading ({@link isSensitiveHeaderName}: `Authorization`, `Proxy-Authorization`, `X-Api-Key`, Azure's `api-key`,
  *  `x-goog-api-key`, `Cookie`, any name holding a credential word; not a gateway's own spelling of a name the
@@ -160,12 +163,32 @@ export declare function inheritedHostEnv(policy: InheritEnvPolicy | undefined, f
 export declare function inheritEnvPolicyProblem(value: unknown): string | undefined;
 /** Test seam: never called by production code. */
 export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
+/** What both disclosures say about one set of findings: every withheld name, and those that are this deployment's own
+ *  credential — withheld under every policy — whichever rule withheld them first ({@link ownCredentialJudge}, the
+ *  subtraction's own judgment, over the entry's value in this process's environment: every finding names an entry of
+ *  it). The rest the scrub withheld, and `"all"` or an allow list naming them hands them on. */
+export declare function withheldEnvNames(findings: readonly SecretEnvFinding[]): {
+    names: string[];
+    ownCredentials: string[];
+};
 /**
  * The ONE disclosure point for a scrub's withheld keys. Routed through {@link deliverEngineNotice} — the
  * engine's one notice throat — so a wired `onNotice` seat REPLACES the console line exactly as every
  * other `EngineNotice` does, and an absent seat prints the same words `console.warn` always printed here.
- * `detail.names` carries every withheld key; `detail.ownCredentials`, present only when one was withheld, the
- * subset withheld as the deployment's declared own credentials (kind `own-credential`) rather than by the scrub.
- * Once per PROCESS, never per call or per site; an EMPTY findings array is a no-op.
+ * `detail` is {@link withheldEnvNames}: `names` every withheld key, `ownCredentials` (present only when one was
+ * withheld) the subset that is the deployment's own credential. Once per PROCESS, never per call or per site; an
+ * EMPTY findings array is a no-op.
  */
 export declare function announceSecretEnvScrub(onNotice: ((notice: EngineNotice) => void) | undefined, findings: readonly SecretEnvFinding[]): void;
+/**
+ * The session user's half of the same fact, from the execution environment's `withheldEnv`: the notice telling the
+ * person whose run drives a tool shell which variables of the engine's environment that shell does not receive — names
+ * only, never a value, split as {@link withheldEnvNames} splits them, with the way out for each half (`detail.state`
+ * `"withheld"`); or, when the environment answered `"unknown"`, that the engine could not determine them (`"unknown"`,
+ * no names: an empty list never stands for unknown). `undefined` when nothing is withheld. Minted by the Runner
+ * (`runner/shell-env-withheld.ts`).
+ */
+export declare function withheldEnvUserNotice(withheld: readonly SecretEnvFinding[] | "unknown", at: {
+    sessionId: string;
+    runId?: string | undefined;
+}): EngineNotice | undefined;

package/dist/core/secret-env.js

@@ -281,6 +281,9 @@ export function holdOwnCredentialValues(values, onNotice) {
         indexAdd(held, v);
 }
 const AUTH_SCHEME_VALUE_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+ +(\S[\s\S]*)$/;
+export function authSchemeCredentials(value) {
+    return AUTH_SCHEME_VALUE_RE.exec(value)?.[1];
+}
 const SCHEMED_HEADER_RE = /^(?:proxy-)?authorization$/i;
 export function isCredentialHeaderName(name) {
     return isSensitiveHeaderName(name);
@@ -293,7 +296,7 @@ export function credentialHeaderValues(headers) {
     for (const [name, value] of Object.entries(headers ?? {})) {
         if (typeof value !== "string" || !(isCredentialHeaderName(name) || looksLikeCredentialValue(value)))
             continue;
-        const credentials = AUTH_SCHEME_VALUE_RE.exec(value)?.[1];
+        const credentials = authSchemeCredentials(value);
         if (credentials !== undefined && isSchemedCredentialHeader(name) && notACredentialReason(credentials) !== undefined) {
             out.push(credentials);
             continue;
@@ -324,16 +327,21 @@ export function __resetWithheldEnv() {
     Reflect.set(globalThis, WITHHELD_ENV, { names: NOTHING_NAMED, declared: new Map(), held: new Map() });
     intakeSaid.clear();
 }
-function withholdOwnCredentials(inherited, findings) {
+function ownCredentialJudge() {
     const table = withheldEnvOf();
     if (table.names.length === 0 && table.declared.size === 0 && table.held.size === 0)
-        return inherited;
+        return undefined;
     const own = new Set(table.names.map(envNameKey));
+    return (key, value) => own.has(envNameKey(key)) || (typeof value === "string" && (indexHas(table.declared, value) || indexHas(table.held, value)));
+}
+function withholdOwnCredentials(inherited, findings) {
+    const isOwn = ownCredentialJudge();
+    if (isOwn === undefined)
+        return inherited;
     const kept = [];
     for (const key of Object.keys(inherited)) {
         const value = inherited[key];
-        const ownValue = typeof value === "string" && (indexHas(table.declared, value) || indexHas(table.held, value));
-        if (!own.has(envNameKey(key)) && !ownValue)
+        if (!isOwn(key, value))
             kept.push([key, value]);
         else
             findings?.push({ key, kind: "own-credential", confidence: SECRET_ENV_KIND_CONFIDENCE["own-credential"], source: "secret-env" });
@@ -377,16 +385,44 @@ let secretEnvScrubNoticeAnnounced = false;
 export function __resetSecretEnvScrubNoticeAnnouncement() {
     secretEnvScrubNoticeAnnounced = false;
 }
+export function withheldEnvNames(findings) {
+    const names = [...new Set(findings.map((f) => f.key))];
+    const isOwn = ownCredentialJudge();
+    const ownCredentials = isOwn === undefined ? [] : names.filter((k) => isOwn(k, process.env[k]));
+    return { names, ownCredentials };
+}
 export function announceSecretEnvScrub(onNotice, findings) {
     if (findings.length === 0 || secretEnvScrubNoticeAnnounced)
         return;
     secretEnvScrubNoticeAnnounced = true;
-    const names = findings.map((f) => f.key);
-    const ownCredentials = findings.filter((f) => f.kind === "own-credential").map((f) => f.key);
+    const { names, ownCredentials } = withheldEnvNames(findings);
     const own = ownCredentials.length > 0 ? `; ${ownCredentials.length} of them this deployment's own credential(s) (${ownCredentials.join(", ")})` : "";
     deliverEngineNotice(onNotice, {
         code: "config.secret_env_scrubbed",
-        message: `secret_env_scrubbed: ${findings.length} env key(s) withheld from a spawned child's environment (${names.join(", ")})${own} — once per process; wire onNotice for the structured form`,
+        message: `secret_env_scrubbed: ${names.length} env key(s) withheld from a spawned child's environment (${names.join(", ")})${own} — once per process; wire onNotice for the structured form`,
         detail: { names, ...(ownCredentials.length > 0 ? { ownCredentials } : {}) },
     });
 }
+export function withheldEnvUserNotice(withheld, at) {
+    const route = { sessionId: at.sessionId, ...(at.runId !== undefined ? { runId: at.runId } : {}) };
+    if (withheld === "unknown") {
+        return {
+            code: "inherit_env.names_withheld",
+            message: "The engine could not determine which variables of its environment the tool shell in this session does not receive: the execution environment does not say. Variables you set may read as unset there.",
+            detail: { state: "unknown", ...route },
+        };
+    }
+    const { names, ownCredentials } = withheldEnvNames(withheld);
+    if (names.length === 0)
+        return undefined;
+    const scrubbed = names.filter((k) => !ownCredentials.includes(k));
+    const halves = [
+        ...(scrubbed.length > 0 ? [`${scrubbed.join(", ")} — withheld by the credential scrub; the run's inheritEnv ("all", or a list naming them) hands them on`] : []),
+        ...(ownCredentials.length > 0 ? [`${ownCredentials.join(", ")} — this deployment's own credential(s), withheld under every inheritEnv`] : []),
+    ];
+    return {
+        code: "inherit_env.names_withheld",
+        message: `The tool shell in this session does not receive ${names.length} variable(s) of the engine's environment: ${halves.join("; ")}. Values are never shown.`,
+        detail: { state: "withheld", names, ...(ownCredentials.length > 0 ? { ownCredentials } : {}), ...route },
+    };
+}

package/dist/core/select-model.js

@@ -1,3 +1,4 @@
+import { capabilityHeld } from "../brain/model-capability.js";
 function asList(models) {
     return Array.isArray(models) ? models : Object.values(models);
 }
@@ -9,9 +10,8 @@ function costOf(m) {
 }
 function matches(m, c) {
     for (const need of c.needs ?? []) {
-        if (need === "vision" && !m.input?.includes("image"))
-            return false;
-        if (need === "reasoning" && !m.reasoning)
+        const cap = need === "vision" ? "image" : need === "reasoning" ? "reasoning" : undefined;
+        if (cap !== undefined && !capabilityHeld(m, cap))
             return false;
     }
     if (c.minContext != null && (m.contextTokens ?? m.contextWindow ?? 0) < c.minContext) {

package/dist/core/sensitive-path-policy.d.ts

@@ -23,7 +23,7 @@ import type { ToolPolicy } from "./tool-policy.js";
 export declare function agentConfigDenyPatterns(): readonly string[];
 /**
  * RECOMMENDED default pattern set for {@link createSensitivePathPolicy} (additive export).
- * NO upstream verbatim anchor exists (cc-anchors/2.1.209 carries no sensitive/dangerous file-pattern
+ * NO upstream anchor exists (the anchor set carries no sensitive/dangerous file-pattern
  * material), so this is an ENGINEERING-CONSENSUS set — each line states its tradeoff. The factory's
  * default behavior is unchanged (no implicit default list; wiring this set is the caller's opt-in:
  * `createSensitivePathPolicy({ patterns: RECOMMENDED_SENSITIVE_PATTERNS, … })`).

package/dist/core/sensitive-path-policy.js

@@ -134,7 +134,7 @@ export function createSensitivePathPolicy(opts) {
         const fold = CASE_INSENSITIVE_FS ? "ascii" : "none";
         const lower = (segs) => (CASE_INSENSITIVE_FS ? segs.map((seg) => seg.replace(/[A-Z]/g, (c) => c.toLowerCase())) : segs);
         const anchors = [configRoot, ...(env === undefined ? [] : await canonicalDataRootKeys(env, [configRoot], signal))].map((root) => lower(agentConfigDirSegments(root)));
-        return configRows.map(({ raw, tail }) => ({ ...(compileSegmentPattern(tail, fold) ?? { raw, segments: [], foldAscii: CASE_INSENSITIVE_FS }), raw, anchors, rootedOnly: true }));
+        return configRows.map(({ raw, tail }) => ({ ...(compileSegmentPattern(tail, fold) ?? { raw, segments: [], fold }), raw, anchors, rootedOnly: true }));
     };
     const rowsOf = async (env, signal) => [...guardRows, ...(await configTwins(env, signal)).map(rowOf)];
     const unstampedRoots = Object.freeze(dataRootSpellings(undefined));